1. Administration is an attack surface too

The tooling that manages users is as security-sensitive as the access it grants. Provisioning, de-provisioning, and permission changes are exactly the operations an attacker wants — create a user, elevate a permit, remove an inconvenient suspension. Treating user management as a first-class, guarded capability is part of the security model, not separate from it.

2. Permits and permissions, cleanly

B5 Secure expresses access as permits and permissions that the authorization pipeline resolves, and gives administrators the means to add, remove, and suspend users and to manage those grants. Because the same convention-driven permission model governs both the application and its administration, what an admin can grant is itself bounded by least privilege.

3. Guarded by the same pipeline

Every administrative action runs through the same verification stages as any other request — authenticated, authorized per data element, posture-checked — and suspension applies to administrators too. There is no privileged side channel that escapes the controls it manages.